WPFT632.CNV

[Radu]

Hi,

We have enabled rule 2844 Microsoft Word WordPerfect5 Converter Module Buffer Overflow Vulnerability and triggered lots of blocked event and the error attached. According to KB94876 and update-guide/vulnerability/CVE-2021-40444 from MS, a new rule was created to minimize the false positives and MS fix it under a security update back in November 2021. 

All devices are up to date in terms of MS patches.

1. Is the rule 2844 still needed or replaced by new rule from Trellix KB?

2. If devices are up to date, rule 2844 or new rule still needed?

Thank you

[Pravas]

Hi @Radu ,

Exploit Signature 2844 is useful against known IOCs. However, the rule is considered aggressive and may trigger false detections.

1. Is the rule 2844 still needed or replaced by new rule from Trellix KB?

You're advised to use both rules for the time being. We'll wait for the next Exploit Prevention content release to confirm if the existing rule is replaced.

2. If devices are up to date, rule 2844 or new rule still needed?

Yes, unless you've followed the work-around from Microsoft's page below. Its best to leave it enabled for added security.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444

Thanks

[Radu]

Hi,

Understood. Is there a way to get rid of that error that is prompting users, we many complains about this.

Thank you.

[Pravas]

Hi @Radu ,

Please share a copy of an event. Please ensure to remove any Personably Identifiable Information like Hostname/IP Address.

Thanks.

[Radu]

Hi,

ran CProgram Files\Microsoft OfficerootOffice16WINWORD.EXE, which tried to access the file CProgram FilesMicrosoft OfficerootProgramFilesCommonX64Microsoft SharedTEXTCONVWPFT632.CNV, the rule "Microsoft Word WordPerfect5 Converter Module Buffer Overflow Vulnerability", and was blocked. For information about how to respond to this event, see KB85494.
Analyzer  Detector
Analyzer content version 10.6
Product  McAfee Endpoint Security
Analyzer rule  2844
Analyzer rule name Microsoft Word WordPerfect5 Converter Module Buffer Overflow Vulnerability
Product version 10.7
Feature name Exploit Prevention

Threat
Action taken Block
Threat category 'File' class or access
Threat event 18060
Threat handled Yes
Threat name Microsoft Word WordPerfect5 Converter Module Buffer Overflow Vulnerability
Threat severity Critical
Threat type Exploit Prevention

Source
Source description "CProgram FilesMicrosoft OfficeRootOffice16WINWORD.EXE" Automation -Embedding
Source file path CProgram FilesMicrosoft OfficerootOffice16
Source process WINWORD.EXE
Source process signed Yes

Target
Target WPFT632.CNV
Target path CProgram FilesMicrosoft OfficerootProgramFilesCommonX64Microsoft SharedTEXTCONV
Target signed Yes

[Radu]

Hi, 

Any info about the error?

Thank you.

[Pravas]

Hi @Radu ,

Thank you for your patience. Rule ID 2844 description is as follows.

This signature is applicable only on Microsoft Office version 2013 and below as the later versions have been patched by Microsoft. This event indicates an attempt to exploit a vulnerability exists in Microsoft Word that loads WordPerfect5 converter module which contains multiple buffer overflow vulnerabilities.

If the office version is above 2013, then it could be a false positive.

The rule is disabled by default to reduce false alerts.

Incase the detection is reoccurring, please check the following.

1. Does it trigger the rule just by launching  Word?

2. Could it be file specific, meaning it only triggers with a certain file/operation?

Thanks

[Radu]

Hi,

Office version: 2016

1. Does it trigger the rule just by launching  Word?

Yes

2. Could it be file specific, meaning it only triggers with a certain file/operation?

Using word.

If 2844 rule is intended for Office 2013, can i disabled it then, assuming that devices are using up to date MS patches?

Thank you.

[Pravas]

Hi @Radu ,

The Rule was originally written to address the following vulnerabilities.

CVE-2013-1324
CVE-2013-1325
CVE-2013-0082

These should have been addressed by MS on Office 2016 as the last version affected by this vulnerability was MS Office 2013

Source - https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-091

I would suggest to try the following.

*Try this on one affected system.

1. Run Getsusp

https://www.trellix.com/en-us/downloads/free-tools/getsusp.html

2. Run Stinger

https://www.trellix.com/en-us/downloads/free-tools/stinger.html

3. Then uncheck the rule for this particular system and monitor

If everything looks good. Then the rule can be gradually disabled for other affected systems.

Thanks